EUVD-2026-15147
GHSA-mpf9-68p5-x53h
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log data sanitization
|
| Impact | Without a CVSS vector or EPSS score provided, the real-world risk must be assessed using available signals: the vulnerability is tagged as information disclosure (not code execution), requires no special privileges for an app to trigger, and affects all major Apple platforms simultaneously. The multi-platform patch timeline suggests Apple considered this moderately serious (not a zero-day emergency, but included in routine security updates). The absence of KEV listing and public POC indicates no known active exploitation. Risk is primarily to confidentiality of kernel memory; integrity and availability are unaffected. In SSVC terms, this represents a situation with exploitation feasible (logging is universal and apps can trigger log generation) but impact limited to information disclosure of kernel-level data, making it a moderate-priority fix rather than critical. Organizations should prioritize patching based on data sensitivity (medical, financial, or security-critical deployments warrant faster patching) but this is not an imminent threat. |
| Exploit ScenarioDerived | A malicious or compromised third-party app running on an affected iPhone or Mac with standard user privileges could trigger verbose system logging (e.g., via intensive I/O operations, networking, or memory allocation patterns) and then read log files accessible to applications. Due to insufficient redaction, these logs would contain unredacted kernel memory contents including heap pointers, kernel structure addresses, or other sensitive data. An attacker could use this information to map kernel memory layout, bypass Address Space Layout Randomization (ASLR), or stage a follow-up kernel exploitation attack. The attack requires user-level execution only, making it accessible to any installed app. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A logging issue in Apple's operating systems allows improper data redaction, potentially enabling applications to disclose kernel memory contents. This information disclosure vulnerability affects iOS and iPadOS (versions prior to 18.7.7 and 26.4), macOS (Sequoia 15.7.5, Sonoma 14.8.5, Tahoe 26.4), visionOS 26.4, and watchOS 26.4. An untrusted application with standard execution privileges could exploit this to read sensitive kernel memory that should have been redacted from logs, potentially exposing cryptographic material, memory addresses useful for ASLR bypass, or other privileged information. No CVSS score, EPSS data, or public proof-of-concept has been disclosed at this time, and this does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog.
RemediationAI
Update affected devices to the patched versions immediately: iOS and iPadOS to version 18.7.7 or 26.4 or later; macOS to Sequoia 15.7.5, Sonoma 14.8.5, or Tahoe 26.4 or later; visionOS to 26.4 or later; and watchOS to 26.4 or later. Users should enable automatic security updates in Settings (iOS/iPadOS/watchOS) or System Settings (macOS/visionOS) to prevent future exposure. For organizations managing large device fleets, use Mobile Device Management (MDM) or enterprise management tools to enforce patch deployment. Until patching is complete, monitor application behavior and restrict third-party app installation to trusted sources only. No workarounds exist for the underlying logging redaction issue; patching is the only remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Apple's logging subsystem across multiple platforms (iOS/iPadOS, macOS, visionOS, watchOS as identified via CPE strings cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos, cpe:2.3:a:apple:watchos). The root cause is insufficient data redaction in logging mechanisms, allowing kernel memory disclosure—a classic information disclosure flaw (analogous to CWE-200: Exposure of Sensitive Information). When applications or system services generate log entries containing sensitive kernel data, the logging framework fails to properly sanitize or mask this information before it becomes accessible to applications. This could stem from inadequate filtering rules, incomplete redaction patterns, or race conditions between memory access and log sanitization routines.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. An app may be able to disclose kernel memory.
Executive ViewAI
Organizations using A logging should be aware of moderate risk from CVE-2026-28868, a log file exposure vulnerability rated CVSS 5.5. This could allow unauthorized file access. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict endpoint access, redact sensitive data in logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a deni
Exploit-DB